Chronicle CMS Overview

Learn more on how Netenrich leverages the potential of Content Management System in Resolution Intelligence Cloud from the following video.

Chronicle enables you to view telemetry, entity context, relationships, and vulnerabilities as a single detection within your Chronicle account. It provides entity contextualization to enable you to understand both the behavioral patterns in telemetry and the context of those impacted entities from those patterns.

Examples:

• Surfacing the permissions for an account on which a brute force login is being attempted.
• Importance of data hosted by an asset that is also the source of outbound network activity.

Chronicle Content Management System consists of the following entities.

• Detection Rules
• Content Packs
• Reference Lists
• Parsers 
• Threat Feeds

With Chronicle content management system, you can manage multiple chronicle instances from single page. It enables role-based access control to create, review and publish content.

Resolution Intelligence supports multitenancy where you can create multiple organizations and tenants in a hierarchical manner in order to serve the chronicle instances that created at your end.

Resolution Intelligence Security platform consists of three levels of hierarchy for deploying rules on top of the Chronicle data -- Domain, Organization and Tenant. Again, there are three user roles such as Creator, Publisher, and Viewer under each category. 

Resolution Intelligence Security platform is capable of showing the audit log on the different activities carried out by each individual or a group.